Skip to content
LumenFlow

Connected Compute contracts

@lumenflow/control-plane-sdk’s connected-compute/ module (WU-3523, INIT-091 phase 3) generalises the private-MCP assignment and typed-result wire contract (WU-3509) to every Connected Compute assignment, and adds a runner-side content-safety guard that contract never had.

Assignment and result contract

Section titled “Assignment and result contract”

Every assignment and result shares a correlation envelope — workspace_id, assignment_id, invocation_id, connector_binding_id, connector_class, manifest_revision/manifest_digest, idempotency_key, fencing_generation, and receipt_id — plus an opaque, bounded, connector-specific payload.

import {
  ConnectedComputeAssignmentV1Schema,
  ConnectedComputeResultV1Schema,
  connectedComputeResultMatchesAssignmentFencingV1,
} from '@lumenflow/control-plane-sdk';

const assignment = ConnectedComputeAssignmentV1Schema.parse(rawAssignment);

connector_class is the open extension point that makes the envelope connector-agnostic — 'private_mcp' is the only class implemented today (WU-3509); it’s a bounded label rather than a fixed enum so a future connector class doesn’t require re-versioning this schema.

A typed result carries a terminal status (succeeded / failed), structured_result or a typed error, artifact_references and evidence_references, usage and cost, and — on failure — an error_class/retryable pair drawn from the contract spine’s error taxonomy. connectedComputeResultMatchesAssignmentFencingV1 proves a result was minted under the same ownership epoch the runner was issued; a caller must reject a result whose fencing generation doesn’t match rather than resuming from it.

This is a generalisation, not a fork: WU-3509’s private-MCP shape is proven to fit inside this envelope unmodified — connectedComputeResultV1FromPrivateMcpResultCommitV1 projects a private MCP result commit onto the generalised contract, and a test asserts the private-MCP shape is a conformant specialisation.

Never-send guard

Section titled “Never-send guard”

The dossier states Cloud must never send, inside a Connected Compute assignment payload: shell commands, executable paths, private URLs, raw credentials, unbounded code, or environment contents. The never-send guard is the runner-side content check that enforces exactly that — layered on top of, not instead of, the shape validation above.

import {
  evaluateNeverSendGuardV1,
  assertNeverSendGuardV1,
  NEVER_SEND_REASON_CODE,
} from '@lumenflow/control-plane-sdk';

const verdict = evaluateNeverSendGuardV1(assignment);
if (verdict.verdict === 'rejected') {
  // verdict.forbidden_class, verdict.reason_code, verdict.path
}

assertNeverSendGuardV1(assignment); // throws NeverSendGuardViolationError on rejection

The guard walks every string leaf of the payload and fails closed — its only two outcomes are allowed and rejected; there is no “uncertain, allow” branch. It detects the canonical shape of each of the six forbidden classes by signature (fixed patterns and structural checks), not by exhaustive classification:

| Forbidden class | Reason code | Detects | | -------------------- | --------------------------------- | --------------------------------------------------------------------------------------------------------------------- | | Shell command | NEVER_SEND_SHELL_COMMAND | sh -c, cmd /c, powershell -command, or a leading #! shebang | | Executable path | NEVER_SEND_EXECUTABLE_PATH | A Windows .exe/.bat/.cmd/.ps1/.dll path, or a POSIX /bin//sbin path or .sh/.exe/.dylib/.so file | | Private URL | NEVER_SEND_PRIVATE_URL | A URL whose hostname resolves to loopback, RFC1918 private space, link-local, or .local/.internal | | Raw credential | NEVER_SEND_RAW_CREDENTIAL | PEM private-key material, an AWS access key id, or a bearer token | | Unbounded code | NEVER_SEND_UNBOUNDED_CODE | A multi-line blob containing a recognisable function/class/import construct | | Environment contents | NEVER_SEND_ENVIRONMENT_CONTENTS | Three or more consecutive KEY=value lines |

Detector order is fixed: the guard reports the first forbidden class it finds, so a payload matching more than one class is always reported under the same reason code.

Section titled “Related”
  • Contract spine — the shared error taxonomy Connected Compute results classify against.
  • Runner deployment — the container and Kubernetes deployment modes that run this contract’s assignments.